Binance Hit by Record $6.3 Billion Hack Linked to North Korea

By Nodora News · 31 October 2026 · Updated 1 November

Attackers drained about $6.3 billion from Binance's hot wallets in the largest crypto theft on record. Here's how it happened, where the money went and what Binance is doing next.

Binance, the world's largest crypto exchange, has lost about $6.3 billion in digital assets in what analysts describe as the biggest crypto theft ever recorded. The attack on Thursday, October 29, 2026, drained the exchange's hot wallets across roughly ten blockchains in a matter of hours. Blockchain investigators have linked it to North Korean hackers, and Binance says it will cover every customer loss from its own funds.

What happened

Late on October 29 (US time), funds began flowing out of Binance's hot wallets, the internet-connected wallets an exchange uses to pay out customer withdrawals. According to TRM Labs, most of the money left in about 20 minutes.

Estimates of the total differ slightly depending on who is counting:

• Binance: about $6.3 billion
• TRM Labs: about $6.36 billion across ten blockchains
• Chainalysis: about $6.4 billion
• Elliptic: about $6.43 billion across 11 blockchains

Any of these figures is roughly four times the $1.5 billion taken from Bybit in February 2025, which held the previous record.

How the attackers got in

Binance co-CEO Richard Teng said early checks pointed to a DevOps engineer's laptop that had been compromised. That gave the attacker a foothold in a service container, a sealed-off piece of Binance's software systems, from which unauthorized withdrawal requests were sent.

Teng stressed it was not a simple "one-click" job using a single employee's access, and said no one person has been blamed. Binance later said its investigation had uncovered additional points of breach. So far, it says it has found no evidence that any wallet private key, the secret code that controls funds, was leaked.

Blockchain analytics firms TRM Labs, Chainalysis and Elliptic all attribute the theft to North Korea. TRM and Chainalysis name TraderTraitor, a unit linked to the Lazarus Group. A key clue: some stolen funds reached the same addresses as money from last month's Bitget hack, which was also tied to North Korea. As Elliptic notes, no government has formally confirmed who was responsible.

The money trail

Stablecoins proved the easiest assets to stop, because their issuers can block the tokens at specific addresses. Bitcoin has no central issuer, so it is much harder to freeze.

• About $3 billion has been frozen, according to Binance, with independent estimates near $2.8 billion
• Tether says it froze more than $1.57 billion in USDT, and Circle more than $800 million in USDC
• About 18,270 BTC (roughly $1.4 billion) was split into 19 wallets, and a CoinDesk trace found none of it had moved as of early Friday UTC
• The attacker has been swapping other tokens into ETH and moving funds between blockchains

Binance says it is working with law enforcement, and a source told Cointelegraph that includes the FBI. The FBI has not publicly commented.

How Binance is responding

Binance says it has set aside more than $6.34 billion of company money to cover losses. About $5 billion of that is already held in the same tokens that were stolen. The remaining roughly $1.3 billion is being bought on the open market and through over-the-counter (OTC) deals, which may take time for less-traded tokens.

Deposits are working, but withdrawals are paused while Binance rebuilds and tests its withdrawal system. Teng has said the exchange aims to reopen withdrawals by Sunday, November 1, but only once security testing is complete. Binance is also targeting a full proof-of-reserves report, a public snapshot of the assets backing customer balances, by Monday, November 2.

The hack has also drawn regulators into the debate. Commodity Futures Trading Commission (CFTC) chair Michael Selig told CNBC that the breach "proves our exact point" about unregulated offshore exchanges. He said the agency wants to give such platforms a way to register in the US and follow its cybersecurity rules.

Market reaction

News of the hack hit prices across the market. CoinDesk reported that liquidations, where leveraged trades are forcibly closed, jumped to about $1.57 billion, and bitcoin fell to around $76,400, its lowest level since September 18. BNB, Binance's own token, dropped more than 6% on Friday.

As of 10:17 AM AEDT on Saturday, October 31, OKX prices were:

• BTC: about $76,960 (down 2.4% in 24 hours)
• ETH: about $2,237 (down 1.5%)
• BNB: about $701.50 (down 0.6%)

What to watch next

The next few days will show whether Binance meets its own deadlines. The main things to watch:

• Whether withdrawals reopen around November 1, and for which assets
• The proof-of-reserves report and how it treats frozen funds
• Any movement from the 19 bitcoin wallets, which could show where the funds are being laundered
• Formal attribution by governments or law enforcement
• A fuller explanation from Binance of the additional breach points

#Binance #Hack #Security #North Korea #Bitcoin

This article is general information, not financial advice.